AIKIDO-2026-995117

TL;DR

The upgradeWebSocket helper retains each upgrade request's IncomingMessage and a pending waiter promise in an internal map until a successful handshake emits connection or the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event fires, so neither cleanup path runs and the map entry is retained forever. An unauthenticated attacker can flood a public upgrade route with failed pre-handshake requests and gradually exhaust memory until the process becomes unavailable. The fix rejects and deletes the waiter on aborted or failed upgrade paths, including when the underlying socket closes before the handshake completes.